(Solution) Using Frontpage with Apache's .htaccess Mod Rewrite prevents FrontPage from being able to

[Robb Topolski]

I found this today, so I may not have shaken out all of the problems with
it.



Problem:

When using Frontpage to edit a website hosted on an Apache server, using Mod
Rewrite to prevent image bandwidth leeching would prevent FrontPage
Extensions from being able to edit the web. One workaround would be to
place all the images in one subdirectory, then put an .htaccess file there.
Since my website was well established, I wanted to avoid that and host my
modify the .htaccess file at the top of my website.

Workaround:

1. This is the .htaccess file at the \ directory of my website.

# -FrontPage-

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET>
order deny,allow
deny from all
allow from all
</Limit>
<Limit POST PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName (set by host)
AuthUserFile (set by host)/_vti_pvt/service.pwd
AuthGroupFile (set by host)/_vti_pvt/service.grp

# - Manual -

RewriteEngine On
RewriteCond %{HTTP_REFERER} !mydomainname\. [NC]
RewriteCond %{HTTP_REFERER} !otherdomainname\. [NC]
RewriteRule [^/]+.(gif|jpg|png|wmv|avi|rm)$ - [NC,F]


2. And here's the key that makes it work: This is the .htaccess file at
the \vti_bin directory of my website. Notice the last line.

# -FrontPage-

Options None

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName (set by host)
AuthUserFile (set by host)/_vti_pvt/service.pwd
AuthGroupFile (set by host)/_vti_pvt/service.grp


# -Manual-

RewriteEngine Off



Explanation: I found that if "RewriteEngine On" was the state, that I could
not communicate with the extensions. Snooping using Ethereal, I found that
FrontPage was doing a POST to /_vti_bin/shtml.exe/_vti_rpc and was getting a
403 (Forbidden) response. Putting the "RewriteEngine Off" directive in only
that subdirectory's .htaccess file solved the problem.

Robb Topolski

 

[Robb Topolski]

Hi, Robb Topolski again,

I found a couple of wrinkles with my strategy and have worked around
them:

1. FrontPage itself would get the Broken Image symbol because it
does not send "Referrer." This was still better than the previous
access denied problem, but I didn't want to have any problem at all.

2. Users could go around the security by using any referral URL that
had your domain in it, such as
http://www.someotherdomain.com/stealfrom?www.yourdomain.com
.... which was not a problem with my particular FrontPage hack, but is
a problem with my .htaccess ModRewrite Conditions.

Changes added below inlined, but without the quote characters...
Hope this helps someone... Comments welcome in the forum.

Robb Topolski
(Do not send e-mail)

1. This is the .htaccess file at the \ directory of my website.

# -FrontPage-

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET>
order deny,allow
deny from all
allow from all
</Limit>
<Limit POST PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName (set by host)
AuthUserFile (set by host)/_vti_pvt/service.pwd
AuthGroupFile (set by host)/_vti_pvt/service.grp

# - Manual -

RewriteEngine On

RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomainname\. [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?otherdomainname\. [NC]
RewriteCond %{HTTP_USER_AGENT} !FrontPage [NC]

RewriteRule [^/]+.(gif|jpg|png|wmv|avi|rm)$ - [NC,F]


2. And here's the key that makes it work: This is the .htaccess file at
the \vti_bin directory of my website. Notice the last line.

# -FrontPage-

Options None

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName (set by host)
AuthUserFile (set by host)/_vti_pvt/service.pwd
AuthGroupFile (set by host)/_vti_pvt/service.grp


# -Manual-

RewriteEngine Off



Explanation: I found that if "RewriteEngine On" was the state, that I could
not communicate with the extensions. Snooping using Ethereal, I found that
FrontPage was doing a POST to /_vti_bin/shtml.exe/_vti_rpc and was getting a
403 (Forbidden) response. Putting the "RewriteEngine Off" directive in only
that subdirectory's .htaccess file solved the problem.

Robb Topolski